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AMENDMENTS TO THE SPECIFICATION 



Please replace the specification with the attached substitute specification. No new 
matter has been added. 
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METHOD AND DEVICE FOR AUTHENTICATING A SUBSCRIBER FOR 
UTILIZING SERVICES IN A WIRELESS LAN WHILE USING AN IP 
MULTIMEDIA SUBSYSTEM OF A MOBILE RADIO NETWORK 

5 CLAIM FOR PRIORITY 

This application is a national stage of PCT/EP02/06269, 
published in the German language on December 18^ 2003, 
which was filed on June 1, 2002. 

10 TECHNICAL FIELD OF THE INVENTION 

The invention relates to a method and device for 
authenticating a subscriber for utilizing services in a 
wireless LAN while using an IP multimedia subsystem of a 
mobile radio network. 

15 

BACKGROUND OF THE INVENTION 
A method for authenticating WLAN subscribers in a mobile 
radio network is described in the journal ''Funkschau'' , 
issued 09/2002, pages 14-15, namely authentication via a 
20 NAI (Network Access Identifier) and optionally via a SIM 
card, and authentication using the IPv6 (Internet 
Protocol Version 6) and a so-called SIM-6 mechanism. In 
general, authentication of a wireless LAN subscriber is 
effected via an HTTP protocol. 

25 

WO 00/76249 Al describes a method of authorizing an 
Internet protocol-enabled mobile device to access the 
Internet via a wireless LAN (WLAN) , GSM or UMTS network, 
whereby the transmission of an IP access request is 
30 initiated from the mobile device to an IP router via the 
access network. In response to receipt of the access 
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request at the IP router, an IP address routing prefix is 

sent from the IP router to the mobile device. The IP 
router then only forwards IP packets to the mobile device 
if it has first received an authorization message from a 
5 control point. The control point monitors the payment 
(electronic cash) from the mobile device for use of the 
Internet. 

US 2002/0062379 Al describes the setting up of a 
10 multimedia session involving a mobile device with a 
session packet access bearer, which is established 
between the mobile device and an access point to a packet 
data network via a radio access network. The access point 
is connected to a multimedia system that supports 
15 multimedia session services. Using the session packet 
access bearer, a multimedia session that includes a 
plurality of media data streams is initiated in a mobile 
device. Media packet access bearers are established 
between the mobile device and the access point. 

20 

SUMMARY OF THE INVENTION 
The invention authenticates a subscriber of a wireless 
LAN who is also a mobile radio network subscriber, while 
utilizing services in a mobile radio network. 

25 

Authentication, while using an IP multimedia subsystem, 
according to one embodiment of the invention, has the 
advantage that a subscriber is authenticated for any 
services that can be reached via the wireless LAN, 
30 without the installation of a separate server for 

authentication in the wireless LAN and without separate 
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connection to a corresponding entity in the mobile radio 
network (e.g. HLR/HSS) , which must be contacted by means 
of a connection (interface) especially provided for that 
purpose . 

5 

BRIEF DESCRIPTION OF THE INVENTION 
The invention is explained in greater detail with the 
reference to exemplary embodiments illustrated in the 
Figures, in which: 

10 

Figure 1 shows the architecture with the interfaces 
between a wireless LAN and an IP multimedia 
subsystem. 



15 Figure 2 shows how the WAGW obtains the authentication 
result using a separate P-CSCF/policy control 
function at the location having WLAN coverage. 

Figure .3 shows how the WAGW obtains the authentication 
20 result through the P-CSCF/policy control 

function of the IP multimedia subsystem. 

Figure 4 shows how the WAGW learns the authentication 
result by expanded functionalities. 

25 

DETAILED DESCRIPTION OF THE INVENTION 
Figure 1 shows how the wireless LAN is connected to an IP 
multimedia subsystem (IMS) (3) . A subscriber MT (6) of a 
wireless LAN (10) is connected via a radio interface (11) 
30 to the wireless LAN at a location having wireless LAN 
coverage (hotspot) . For the authentication, the 
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subscriber MT (6) receives an IP address (e.g. through 
DHCP) from the proxy call state control function node (P- 
CSCF) (1) . The subscriber MT (6) can thus authenticate 
himself, by means of SIP registration, in the IMS (3) 
without any prior bearer level authentication (e.g. H/2, 
authentication via the radio interface is optional) . In 
the IMS (3), the authentication takes place on the 
application side in the call state control function node 
(CSCF) (4) via an SIP registration message. This 
authentication guarantees the MT (6) access to specific 
profiles (e.g. WLAN profiles). The CSCF (4) uses an 
authentication that is known per se for the IMS (3), but 
not for a WLAN (10), by means of the home subscriber 
system (HSS) (5) via the Cx interface. The P-CSCF (1) of 
the WLAN (10) receives the result of the authentication 
via an SIP registration request (e.g. 200 OK) . This 
result is transferred to the WLAN access gateway (WAGW) 
(2) . The WAGW (2) controls the access to services and 
monitors the successful authentication in the IMS (3) . 
The wireless LAN (10) is connected to the Gi interface or 
Mm interface with the IMS (3) . The Gi interface is an 
interface within the IP network (7) and is thus subject 
to special security precautions. The geographical 
distance between the IMS (3) and the location having WLAN 
coverage is also taken into account. At the Mm interface, 
the connection between the IMS (3) and the location 
having WLAN coverage (hotspot) is effected via an IP 
multimedia network (Internet) (8) . 

The authentication of an MT (6) in the IMS (3) is carried 
out using the SIP protocol. The result of the 
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authentication in the IMS (3) is fed to the WAGW (2) . 
There are three options for this, which are described 
under Figure 2, Figure 3 and Figure 4. 

5 Figure 2 shows how the WAGW (2) receives the 
authentication result through a separate P-CSCF 
(1) /policy control function at the location having WLAN 
coverage (hotspot) . In this case the WLAN (10) is 
equipped with its own P-CSCF (1), which is used for 

10 forwarding SIP messages to the corresponding entity in 
the IMS (3) (SIP registration request) and controlling 
the WAGW (2) according to the authentication result of 
the IP multimedia subsystem (IMS) (SIP response) . The P- 
CSCF (1) communicates with the CSCF (4) in the IP 

15 multimedia subsystem via a Gi interface or Mm interface 
(via Internet (8)). The P-CSCF . (1) provides the WAGW (2), 
on the basis of the result of the authentication (SIP 
registration) in the IMS (3), with instructions on how 
the data traffic of an MT (6) is to be handled by the 

20 WAGW (2). This enables the WAGW (2) to block the data 
flow, for example. By means of the policy control 
function, the P-CSCF (1) controls the data traffic through 
the WAGW (2), and is able to grant, restrict, increase or 
decline the quantity and quality of the data flow of an 

25 MT (6) through the WAGW (2) . This mechanism is similar to 
the Go interface which is installed between the P-CSCF of 
the IMS (3) and the gateway GPRS support node (GGSN) (9) . 
This policy control function may be part of the P-CSCF (1) 
or may even be a separate unit, which may optionally be 

30 used in addition for the IP multimedia subsystem and the 
PS domains . 
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One possible policy protocol is COPS (RFC 2748, used for 
the Go interface) . The Go interface uses an IP transport^ 
and therefore a protected transfer of COPS messages 
5 within the wireless LAN, or a separate connection (i.e. 
separated from data traffic of subscribers within the 
wireless LAN) between P-CSCF{1) and WAGW (2,) is 
installed during implementation. 

10 Figure 3 shows how the WAGW (2) is notified of the result 
of the IMS authentication by the CSCF (4) of the IMS (3) . 
The CSCF (4) of the IMS (3) controls the WAGW (2). with 
the effect, that it exercises policy functionality. Here, 
however, it is the P-CSCF of the IMS (3) that exercises 

15 control of the WAGW (2), instead of a separate P-CSCF in 
the wireless LAN. 

By means of the policy functionality, the P-CSCF of the 
IMS (3) controls the data traffic through the WAGW (2) 

20 and is able to grant, restrict, increase or decline the 
quantity and quality of the data flow of the MT (6) 
through the WAGW (2) . This mechanism is similar to the 
one in the Go interface which is installed between the P- 
CSCF of the IMS (3) and the GGSN of the PS domains. A Go 

25 interface is installed between the CSCF (4) of the IMS 

(3) and the WAGW (2) of the wireless LANs (10) to ensure 
that data transfer is protected. The WAGW (2) can 
transmit the SIP messages containing the authentication 
result via the Gi interface or via the Mm interface to 

30 the CSCF (4) in the IMS (3). 
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Figure 4 shows how the WAGW (2) itself evaluates the 
authentication result. The WAGW (2) receives the result, 
which indicates whether an authentication of the MT (6) 
has taken place in the IMS (3), and the result of this 
5 authentication. The WAGW (2) then converts the result by 
allowing subscriber data to pass through completely or 
with restrictions. If the WAGW (2) is equipped with a Gi 
interface, it can transmit authentication messages (SIP 
registration) via this interface to the CSCF (4) in the 

10 IMS (3) . Otherwise the Mm- interface is used for this 

purpose- To enable the WAGW (2) to evaluate the result of 
the authentication (SIP messages), it is implemented in 
the form of an "application layer gateway" . In this way 
it can convert the result of an SIP authentication 

15 accordingly without the assistance of a CSCF (4) . The 

WAGW (2) does this by searching the data packets for SIP 
messages (registration requests and responses) and 
interpreting the SIP registration responses accordingly 
for the filtering of subscriber data. So that the WAGW 

20 (2) does not have to open every data packet, a process of 
elimination is carried out on OSI Layer 3 (IP address) or 
OSI Layer 4 (port number) . Thus an IP address, a port 
number or other eliminating factor is used to determine 
whether a data packet or datagram is forwarded to the 

25 next higher OSI layer, or whether it may pass through the 
WAGW (2) . 



